ISO/IEC 27001:2022
International requirements for an information security management system (ISMS). Certification may be provided by a competent certification body; ISO itself does not issue organisational certificates.
CyberFundamentals (CyFun)
A framework published by the Centre for Cybersecurity Belgium, with risk-based assurance levels and specific use in Belgian NIS2 assessment arrangements. Applicable level and assessment depend on entity classification.
SOC 2 and NIST CSF
SOC 2 produces an attestation report over controls at a date or during a period. NIST CSF 2.0 is a risk-management and communication framework, not a certification issued by NIST.
Choose based on outcomes
Start with legal duties, customer contracts and operational scope. Build a shared risk register, control mapping and evidence inventory, then prepare each assurance exercise separately.
At a glance
| Reference | Form | Who assesses? |
|---|---|---|
| ISO 27001 | Possible certification | Certification body |
| CyFun | Belgian framework assessment | Body/authority under applicable regime |
| SOC 2 | Attestation report | Qualified practitioner |
| NIST CSF | Voluntary framework | No NIST certification |
How SFERE can support
SFERE supports technical readiness and evidence governance, not accredited assessment.
Official laws, standards & publisher resources
This is an editorial explanation. Verify consolidated laws, applicable standards and interpretations for your activity, country and date. Full standards may require a licence.